Chrome · GPU
CVE-2026-14037
Logic Error in GPU
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
components/viz/service/frame_sinks/compositor_frame_sink_support.cccomponents/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
Patch
From 8b19dcd1ffef5628f8b82b461884ef195470ffa2 Mon Sep 17 00:00:00 2001 From: Zhenyao Mo <[email protected]> Date: Wed, 20 May 2026 08:59:31 -0700 Subject: [PATCH] viz: Support TreesInViz check in BindLayerContext Bug: 496522611 Change-Id: I149e96384d9c161c6353a936ca90863accf1400c TEST=viz_unittests Change-Id: I149e96384d9c161c6353a936ca90863accf1400c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861920 Auto-Submit: Zhenyao Mo <[email protected]> Commit-Queue: Vasiliy Telezhnikov <[email protected]> Reviewed-by: Vasiliy Telezhnikov <[email protected]> Commit-Queue: Zhenyao Mo <[email protected]> Reviewed-by: Tzarial <[email protected]> Cr-Commit-Position: refs/heads/main@{#1633621} --- diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc index d81eba6..8e3368626 100644 --- a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc +++ b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc @@ -624,6 +624,9 @@ void CompositorFrameSinkSupport::BindLayerContext( mojom::PendingLayerContext& context, mojom::LayerContextSettingsPtr settings) { + if (!base::FeatureList::IsEnabled(features::kTreesInViz)) { + return; + } layer_context_ = std::make_unique<LayerContextImpl>(this, context, std::move(settings)); } diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc index bec1b6f..b18e905 100644 --- a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc +++ b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc @@ -2929,4 +2929,28 @@ support->SendCompositorFrameAck(); } +TEST_P(AckOnSurfaceActivationWhenInteractiveTest, + TreesInVizDisabledDoesNotBindLayerContext) { + base::test::ScopedFeatureList scoped_feature_list; + scoped_feature_list.InitAndDisableFeature(features::kTreesInViz); + manager_->RegisterFrameSinkId(kAnotherArbitraryFrameSinkId, + true /* report_activation */); + MockCompositorFrameSinkClient mock_client; + auto support = std::make_unique<CompositorFrameSinkSupport>( + &mock_client, manager_.get(), kAnotherArbitraryFrameSinkId, kIsRoot); + + auto context = mojom::PendingLayerContext::New(); + mojo::AssociatedRemote<mojom::LayerContext> layer_context; + context->receiver = layer_context.BindNewEndpointAndPassReceiver(); + MockLayerContextClient mock_layer_context_client; + mojo::AssociatedReceiver<mojom::LayerContextClient> + layer_context_client_receiver( + &mock_layer_context_client, + context->client.InitWithNewEndpointAndPassReceiver()); + + auto settings = mojom::LayerContextSettings::New(); + support->BindLayerContext(*context, std::move(settings)); + EXPECT_EQ(support->layer_context_for_testing(), nullptr); +} + } // namespace viz
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
index bec1b6f..b18e905 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
@@ -2929,4 +2929,28 @@
support->SendCompositorFrameAck();
}
+TEST_P(AckOnSurfaceActivationWhenInteractiveTest,
+ TreesInVizDisabledDoesNotBindLayerContext) {
+ base::test::ScopedFeatureList scoped_feature_list;
+ scoped_feature_list.InitAndDisableFeature(features::kTreesInViz);
+ manager_->RegisterFrameSinkId(kAnotherArbitraryFrameSinkId,
+ true /* report_activation */);
+ MockCompositorFrameSinkClient mock_client;
+ auto support = std::make_unique<CompositorFrameSinkSupport>(
+ &mock_client, manager_.get(), kAnotherArbitraryFrameSinkId, kIsRoot);
+
+ auto context = mojom::PendingLayerContext::New();
+ mojo::AssociatedRemote<mojom::LayerContext> layer_context;
+ context->receiver = layer_context.BindNewEndpointAndPassReceiver();
+ MockLayerContextClient mock_layer_context_client;
+ mojo::AssociatedReceiver<mojom::LayerContextClient>
+ layer_context_client_receiver(
+ &mock_layer_context_client,
+ context->client.InitWithNewEndpointAndPassReceiver());
+
+ auto settings = mojom::LayerContextSettings::New();
+ support->BindLayerContext(*context, std::move(settings));
+ EXPECT_EQ(support->layer_context_for_testing(), nullptr);
+}
+
} // namespace viz
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page